Re: [whatwg/fetch] Hide range values from no-cors cross-origin range requests (Issue #1936)

jakearchibald left a comment (whatwg/fetch#1936)

The conclusion in WHATNOT was to go with [none of the options](https://github.com/whatwg/fetch/issues/1936#issuecomment-4797544826), and instead, if the request is from media, and no-cors, it skips the service worker.

This means developers must use the `crossorigin` attribute on media elements to make them CORS requests, even if they're same origin.

I'm ok with this, given the security issues, and how hacky the other options were.

I'm curious what Chrome folks think about this.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1936#issuecomment-4802023793
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1936/4802023793@github.com>